[janedbal]

The rule now also searches arguments of nested calls for the caught exception. Before, it checked only the direct arguments of the thrown call.

This code caused a false positive:

try {
    // ...
} catch (LoginLockedException $e) {
    throw new HttpException(401, $msg, TooManyLoginAttemptsException::fromLock($e));
}

• The rule searches nested calls at any depth, e.g. new Outer(Inner::wrap(new Other('x', 0, $e))).
• A nested first-class callable, e.g. MyException::create(...), does not count as a pass.
• Limitation: the rule does not check if the nested call chains $e as previous. A nested call that only reads $e also counts as a pass.

Co-Authored-By: Claude Code